CVE-2019-20485: debian debian_linux Improper Input Validation

Modified

AliasesALPINE-CVE-2019-20485MGASA-2020-0283RHBA-2020:2017+2 more

Published 19-03-2020Last modified 05-08-2024

Vulnerability summary

CVE-2019-20485 is a medium (CVSS 5.7) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 57% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.7, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.7/10

010

Medium · v3.1 (NVD)

EPSS score

0.81%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2020:4000 RHSA-2020:4676

Timeline

19-03-2020
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

CVSS metrics

6 scores · 5 sources · 2 versions

v3.15.7v2.02.7

EPSS trend

Probability

0.81%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.81% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat194 products

libvirt< 6.0.0
hivex< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
hivex-debuginfo< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
hivex-debugsource< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
hivex-devel< 0:1.3.18-20.module+el8.2.0+5588+63a201c3

libguestfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-bash-completion< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-benchmarking< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-benchmarking-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-debugsource< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-devel< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-gfs2< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-gobject< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-gobject-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-gobject-devel< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-inspect-icons< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-java< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-java-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-java-devel< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-javadoc< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-man-pages-ja< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-man-pages-uk< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-rescue< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-rsync< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-tools< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-tools-c< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-tools-c-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libguestfs-winsupport< 0:8.2-1.module+el8.2.0+5590+82cd80df
libguestfs-xfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
libiscsi< 0:1.18.0-8.module+el8.2.0+4793+b09dd2fb
libiscsi-debuginfo< 0:1.18.0-8.module+el8.2.0+4793+b09dd2fb
libiscsi-debugsource< 0:1.18.0-8.module+el8.2.0+4793+b09dd2fb
libiscsi-devel< 0:1.18.0-8.module+el8.2.0+4793+b09dd2fb
libiscsi-utils< 0:1.18.0-8.module+el8.2.0+4793+b09dd2fb
libiscsi-utils-debuginfo< 0:1.18.0-8.module+el8.2.0+4793+b09dd2fb
libnbd< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
libnbd-debuginfo< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
libnbd-debugsource< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
libnbd-devel< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
libtpms< 0:0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb
libtpms-debuginfo< 0:0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb
libtpms-debugsource< 0:0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb
libtpms-devel< 0:0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb
libvirt< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-admin< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-admin-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-bash-completion< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-client< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-client-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-config-network< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-config-nwfilter< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-interface< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-interface-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-network< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-network-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-nodedev< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-nodedev-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-nwfilter< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-nwfilter-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-qemu< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-qemu-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-secret< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-secret-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-core< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-core-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-disk< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-disk-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-gluster< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-gluster-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-iscsi< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-iscsi-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-iscsi-direct< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-iscsi-direct-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-logical< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-logical-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-mpath< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-mpath-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-rbd< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-rbd-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-scsi< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-driver-storage-scsi-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-daemon-kvm< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-dbus< 0:1.3.0-2.module+el8.2.0+4793+b09dd2fb
libvirt-dbus-debuginfo< 0:1.3.0-2.module+el8.2.0+4793+b09dd2fb
libvirt-dbus-debugsource< 0:1.3.0-2.module+el8.2.0+4793+b09dd2fb
libvirt-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-debugsource< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-devel< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-docs< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-libs< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-libs-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-lock-sanlock< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-lock-sanlock-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-nss< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-nss-debuginfo< 0:6.0.0-17.module+el8.2.0+6257+0d066c28
libvirt-python< 0:6.0.0-1.module+el8.2.0+5453+31b2b136
libvirt-python-debugsource< 0:6.0.0-1.module+el8.2.0+5453+31b2b136
lua-guestfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
lua-guestfs-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
nbdfuse< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
nbdfuse-debuginfo< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
nbdkit< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-bash-completion< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-basic-filters< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-basic-filters-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-basic-plugins< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-basic-plugins-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-curl-plugin< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-curl-plugin-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-debugsource< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-devel< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-example-plugins< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-example-plugins-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-gzip-plugin< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-gzip-plugin-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-linuxdisk-plugin< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-linuxdisk-plugin-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-python-plugin< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-python-plugin-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-server< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-server-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-ssh-plugin< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-ssh-plugin-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-vddk-plugin< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-vddk-plugin-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-xz-filter< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
nbdkit-xz-filter-debuginfo< 0:1.16.2-2.module+el8.2.0+5664+dd92f997
netcf< 0:0.2.8-12.module+el8.2.0+4793+b09dd2fb
netcf-debuginfo< 0:0.2.8-12.module+el8.2.0+4793+b09dd2fb
netcf-debugsource< 0:0.2.8-12.module+el8.2.0+4793+b09dd2fb
netcf-devel< 0:0.2.8-12.module+el8.2.0+4793+b09dd2fb
netcf-libs< 0:0.2.8-12.module+el8.2.0+4793+b09dd2fb
netcf-libs-debuginfo< 0:0.2.8-12.module+el8.2.0+4793+b09dd2fb
ocaml-hivex< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
ocaml-hivex-debuginfo< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
ocaml-hivex-devel< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
ocaml-libguestfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
ocaml-libguestfs-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
ocaml-libguestfs-devel< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
ocaml-libnbd< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
ocaml-libnbd-debuginfo< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
ocaml-libnbd-devel< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
perl-hivex< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
perl-hivex-debuginfo< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
perl-Sys-Guestfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
perl-Sys-Guestfs-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
perl-Sys-Virt< 0:6.0.0-1.module+el8.2.0+5488+267def79
perl-Sys-Virt-debuginfo< 0:6.0.0-1.module+el8.2.0+5488+267def79
perl-Sys-Virt-debugsource< 0:6.0.0-1.module+el8.2.0+5488+267def79
python-pyvmomi< 0:6.7.1-7.module+el8.2.0+4793+b09dd2fb
python3-hivex< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
python3-hivex-debuginfo< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
python3-libguestfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
python3-libguestfs-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
python3-libnbd< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
python3-libnbd-debuginfo< 0:1.2.2-1.module+el8.2.0+5644+32ac38d4
python3-libvirt< 0:6.0.0-1.module+el8.2.0+5453+31b2b136
python3-libvirt-debuginfo< 0:6.0.0-1.module+el8.2.0+5453+31b2b136
python3-pyvmomi< 0:6.7.1-7.module+el8.2.0+4793+b09dd2fb
qemu-guest-agent< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-guest-agent-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-img< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-img-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-curl< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-curl-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-gluster< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-gluster-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-iscsi< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-iscsi-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-rbd< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-rbd-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-ssh< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-block-ssh-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-common< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-common-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-core< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-core-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-debugsource< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-tests< 15:4.2.0-19.module+el8.2.0+6296+6b821950
qemu-kvm-tests-debuginfo< 15:4.2.0-19.module+el8.2.0+6296+6b821950
ruby-hivex< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
ruby-hivex-debuginfo< 0:1.3.18-20.module+el8.2.0+5588+63a201c3
ruby-libguestfs< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
ruby-libguestfs-debuginfo< 1:1.40.2-22.module+el8.2.0+6029+618ef2ec
seabios< 0:1.13.0-1.module+el8.2.0+5520+4e5817f3
seabios-bin< 0:1.13.0-1.module+el8.2.0+5520+4e5817f3
seavgabios-bin< 0:1.13.0-1.module+el8.2.0+5520+4e5817f3

Show all 194

Debian2 products

libvirt< 6.0.0-2
debian_linuxEOL8.0 | 9.0 | 10.0

Alpine1 product

libvirt< 5.5.0-r2 | < 5.9.0-r2

Fedoraproject1 product

fedoraEOL31

Mageia1 product

libvirt< 5.5.0-1.2.mga7

Ubuntu1 product

libvirt< 1.3.1-1ubuntu10.30 | < 4.0.0-1ubuntu8.17 | < 6.0.0-0ubuntu4

6 vendors · 200 products · Showing 200 of 222

References

212 links

libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=a663a860819287e041c3de672aad1d8543098eccX Refsource CONFIRM
www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1730509.htmlX Refsource MISC
bugzilla.redhat.com/show_bug.cgi?id=1809740X Refsource MISCREPORTIssue TrackingVendor Advisory
security-tracker.debian.org/tracker/CVE-2019-20485X Refsource MISCAdvisoryThird Party Advisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=953078X Refsource MISCIssue TrackingThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
security.alpinelinux.org/vuln/CVE-2019-20485Advisory
advisories.mageia.org/MGASA-2020-0283.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=26816REPORT
lists.fedoraproject.org/archives/…WEB

Show all 100 references

Showing 100 of 212.